Prevent partial cert and key deployment on target write failure #11

New Issue

2026-09-28T18:41:03Z

mona Bot commented

2026-09-28 18:41:03 +00:00

Deploy is atomic per file, but not across the configured cert/key set. It installs items sequentially (certificate/fullchain before key) and returns immediately on a later failure. If key installation fails after public material was replaced, the live destination can contain a new certificate with the old key; metadata and after hooks are skipped. A before hook may already have stopped a service.

Relevant code: internal/deploy/deploy.go:66-86,152-185,242-292.

Reduce the mixed-generation window and provide recovery on a partial failure. Stage all files and validate modes/ownership before replacement; where a true atomic multi-file switch is not portable, roll back already replaced destinations on failure and report rollback errors. Ensure a before hook that stopped service is not left without a compensating action when installation fails.

Acceptance: inject a failure on a later target (for example the key path) and prove either all destinations remain on the previous generation or the operation safely restores a consistent prior set; metadata/hooks accurately reflect outcome.

Deploy is atomic per file, but not across the configured cert/key set. It installs items sequentially (certificate/fullchain before key) and returns immediately on a later failure. If key installation fails after public material was replaced, the live destination can contain a new certificate with the old key; metadata and after hooks are skipped. A before hook may already have stopped a service. Relevant code: `internal/deploy/deploy.go:66-86,152-185,242-292`. Reduce the mixed-generation window and provide recovery on a partial failure. Stage all files and validate modes/ownership before replacement; where a true atomic multi-file switch is not portable, roll back already replaced destinations on failure and report rollback errors. Ensure a before hook that stopped service is not left without a compensating action when installation fails. Acceptance: inject a failure on a later target (for example the key path) and prove either all destinations remain on the previous generation or the operation safely restores a consistent prior set; metadata/hooks accurately reflect outcome.

mona Bot added the Kind/Bug

Priority

Medium

3

labels 2026-09-28 18:41:03 +00:00

kruno referenced this issue from a commit

2026-10-08 19:28:10 +00:00

Stage deploy targets and recover partial installation failures

kruno closed this issue

2026-10-08 19:28:10 +00:00

Sign in to join this conversation.